Cyber Resilience

CVE-2021-26608

High

Published: 09 September 2021

Published
09 September 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0023 46.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-26608 is a high-severity Missing Support for Integrity Check (CWE-353) vulnerability in Handysoft Hshell. Its CVSS base score is 8.8 (High).

Operationally, ranked at the 46.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

handysoft
hshell
1.7.4.5, 2.0.3.5, 4.0.1.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-345 CWE-353

Mandates provision of authenticity and integrity artifacts that enable verification of name/address resolution data.

addresses: CWE-345 CWE-353

Control requires verification of data authenticity/integrity (e.g., checksums) after aggregation/packing, directly reducing exploitation of insufficient verification before transmission.

addresses: CWE-353 CWE-345

Directly supplies the missing integrity verification mechanism the weakness describes.

addresses: CWE-345 CWE-353

Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.

addresses: CWE-345 CWE-353

The control implements verification mechanisms that detect tampering by ensuring data authenticity.

addresses: CWE-353

Irrefutable evidence of actions requires integrity protection to prevent tampering or alteration of records.

addresses: CWE-353

Implements required signature-based integrity verification, addressing missing support for integrity checks on components.

addresses: CWE-345

Directly requires independent verification of matching output before adverse decisions, mitigating insufficient authenticity checks on data from external sources.

References